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Testing Motron’s 
Transmitter Fingerprinter 


According to many hams, Southern 
California has a reputation for being 
the repeater-jamming capital of the 
world. AS someone who has traveled 
and talked to many repeater owners 
and users, | think that reputation is un- 
deserved. The sad truth is that you 
can find examples of illegal repeater 
use in big cities and small towns ev- 
erywhere. 

With hundreds of coordinated 2 
meter repeaters between Santa Bar- 
bara and the Mexican border, hams 
here can be proud that only a handful 
have ongoing problems with jamming, 
bootleggers, and unidentified trans- 
fhissions. The rest are full of friendly 
and helpful hams who seldom face 
these problems. 

Of course, there aré occasions 
when nets and round tables on even 
our “cleanest” repeaters are brought 
to a halt by carriers, tones, and cuss 
words. When a phone call goes out 
to a radio direction finding (RDF) 
team, the job is not easy if there are 
many perpetrators in scattered !oca- 
tions. It would be a huge help to be 
able to separate and identify which 
transmissicns come from which 
source. 


Radio Direction Finding 


Just Like Snowflakes 


We all know that every human is 
unique and can be identified from all 
others by differences in the skin pai- 
terns on the fingertips and DNA in the 
cells. These methods require the per- 
son to submit to examination or test- 
ing. When this is not possible or de- 
sited, a voiceprint can be done froma 
distance, without the knowledge of the 
subject, at the cost of greater uncer- 
tainty. 

Similarly, every radio transmitter is 
unique. You cannot read the serial 
number on its nameplate from a dis- 
tance, but you can identify it by ana- 
lyzing, with sufficient precision, the 
characteristics of its signal. Differ- 
ences in signals, however slight, are 
always present due to differences in 
individual parts and the randomness 
in factory testing and tuning tech- 
niques. 

You may have heard reports of 
unique transmitter “signatures” and a 
technique called “fingerprinting” to 
identify rigs used for illegal activities 
and to apprehend their owners. What 
these reports usually leave out is the 
fact that this technique was invented 
by a ham and such equipment is now 
available for purchase. 


A Sleepless Experimenter 


When | spent nine months on 
assignment in Seattle back in 1972, 
the city’s most popular repeater 
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Figure 1. Two consecutive transmissions from a crystal-controlled repeater trans- 
mitter. Subaudible tone modulation (CTCSS) is plainly visible. TxID-1 computes 
and displays the CTCSS frequency below the trace. 
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Figure 2. Two consecutive transmissions from the same FT-530 handie-talkie on 
the same frequency. Except for the ringing duration, the fingerprints are almost 


identical. 


was run by Phil Ferrell W7PUG, an 
engineer at The Boeing Company. 
Today, this repeater is as popular as 
ever, Phil is K7PF, and he has retired 
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Photo A. All you need to take transmitter fingerprints is a suitable receiver and a computer with the TxID-1 hardware and soft- 


ware installed. Not shown is an optional tape recorder for documenting audio and fingerprints simultaneously. 
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to work on his own pet projects. 

In the mid ’80s, when unidentified 
signals appeared on the Seattle re- 
peater Phil decided to fight back by 
using his knowledge of signal analysis. 
He reasoned that most of the offend- 
ing transmitters were owned by li- 
censed hams and could be identified 
by comparing their signals to those of 
regular and occasional repeater users. 

The first design challenge was to 
figure out what signal characteristics 
to look at. “I had heard FM transmit- 
ters come on the air on top of one an- 
other,” says Phil. “There would be a 
heterodyne with a chirp or quickly war- 
bling tone at the beginning, as the 
phase-locked loop (PLL) settled on 
frequency. | researched PLL theory, 
which goes into a branch of math in- 
volving Gilbert transforms, That wasn't 
helpful, so | tried looking at it as a low- 
bandwidth FM phenomenon.’ 

After some experimentation, his 
transmitter fingerprinting scheme took 
shape. It takes 2,048 instantaneous 
frequency samples at 100 microsec- 
ond intervals at the beginning of a 
transmission, then averages and filters 
this data to display and record 64 su- 
per-samples of frequency versus time. 

“Amplitude and multipath don’t 
have much effect,” says K7PF. “It's a 
robust technique and works under 
almost all conditions. Even on signals 
of -120 or -125 dBm, when the audio 
is almost unintelligible, the low band- 
width of the system gives a pretty 
decent fingerprint” 
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Figure 3. These two HTX-202 transceivers were bought at the same time, but 
have distinctly different fingerprints. They were set for the same power level on 


the same frequency. 


There were distinctive characteris- 
tics on every radio he tested, even 
those of the same model. “I was show- 
ing the system at a club meeting and a 
husband and wife stood up,” he goes 
on. “They both had brand-new Alinco 
handhelds with adjacent serial num- 
bers. He told me flat out he thought 
they would have identical fingerprints. 
! was standing there kinda sweating 
and said, ‘Well, | don’t think so, but 
we'll take a look. | finished the talk 
and got to the demonstration time and 
they immediately leaped to their feet. 
We checked the rigs and they were 


The newest in the line of rugged 
spectrum analyzers from AVCOM 
offers amazing performance for only 


$2,855. 


like chalk and cheese, totaily different. 

“A small percentage of rigs have 
two or more fingerprints. Theoretically, 
there are two predictable routes for 
PLL fockup. It’s unlikely a given radio 
would be set up so it could take both 
routes, but it can happen.” A rig's fin- 
gerprint may change slightly as you 
tune different parts of the same ham 
band. Dual- and multiband VHF/UHF 
tigs have completely different prints on 
each band. 

K7PF soon realized he had a mar- 
ketable signal identification system. “In 
a rare moment of greed, | ran it past 
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Figure 4. In a rapid-exchange QSO, this TH-78A produces consistent fingerprints 
like the one at left. If the rig sits for a few moments until the battery-saver feature 
activates, the next transmission looks like the trace at right. 


the Boeing patent staff,” he says with a 
chuckle. “That turned out to be a good 
move.” Transmitter fingerprinting is 
now patented and assigned to Boeing, 
who sees to it that nobody makes 
commercial use of this idea without 
compensating Boeing and K7PF for it. 

Next, FCC heard about fingerprint- 
ing and asked for some of Ferrell’s 
equipment to evaluate. About this 
time, Don Moser AA7Y of Motron 
Electronics heard about the system at 
the Sea-Pac ham convention. K7PF 
showed AA7Y his breadboard and 
they worked out a deal for Motron to 


manufacture the circuit boards for Fer- 
rell's FCC contract and to market the 
finished product, called the TxID-1, to 
the public. 


Dozens of 78s 

Phil's description fingerprinting 
made sense to me, but | was a bit 
skeptical at first about just 64 super- 
samples providing positive identifica- 
tion of like-model transmitters. For a 
rigorous test, | decided to take TxID-1 
fo’a meeting of the 78's Amateur Radio 
Club. This group was formed to teach 
the arcane art of programming the 
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AVCOM 'sNewPSA-65A Portable Spectrum Analyzer 


VERT is used to 


SWEEP RATE controls the Position the display 
speed of the sweep across 0" the screen. 
the CRT. 


AVCOM'S new PSA-65A is the 


first low cost general purpose port- 
able spectrum analyzer that’s 
loaded with features. It’s small, 
accurate, battery operated, has a 
wide frequency coverage - a must 
for every technician’s bench. Great 
for field use too. 

The.PSA-65A covers frequen- 
cies thru 1000 MHz in one sweep 
with a sensitivity greater than -90 
dBm at narrow spans. The PSA- 
65A is ideally suited for 2-way ra- 
dio, cellular, cable, LAN, surveil- 
lance, educational, production and 


Portable, attractively styled 
package and ergonometri- 


cally engineered front panel. 


Large bright screen for 
outdoor and indoor use. 


POWER switch has 3 


positions: Battery Operation, 
Standby and AC Line Opera- 


lion, Ext. DC Power switch 
on rear panel for 12 voit 
operation. 


CENTER 


SCALE selects an amplitude es ae 


sensitivity of either 10 dB/DIV 
or 2 dB/DIV 


TUNING adjusts the center frequency of the 
analyzer so that signals of interest appear at the 
center of the display and their frequency is read 
out on the LCD. 


REFERENCE LEVEL adjusts 
input attenuator and IF gain. 
Calibrations in dBm and 
dBmv are provided. 


ZERO SPAN instantly places 
analyzer in zero span mode 
and activates audio 
demodulator for convenient 
monitoring. 


SPAN controls the width of the 
spectrum being displayed and 
aulomatically selects optimum 
resolution filter, 


R&D work. Options include fre- 
quency extenders to enable the 
PSA-65A to be used at SATCOM 
and higher frequencies, audio 
demod for monitoring, log periodic 
antennas, carrying case (AVSAC), 
and more. 

For more information, write, FAX 
or phone. 
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BAT CHG switch recharges PSA-65A to 


80% capacity in approx. 6 hours. RF INPUT accepts signals to be 


observed from less than 2 Mhz to 
greater than 1000 Mhz. 


AUXILIARY supports present 

and future optional 

accessories for the PSA-65A. 
AUDIO DEMOD 
activates audio demod 
board and sets audio 
level. 


AUDIO OUT drives low 
impedence earphone or 
speaker. Internal speaker 
provided with optional demod. 


VAR SPAN reduces the width of 
the spectrum being displayed for 
closer signal examination and 
enhanced amplitude accuracy. 


500 SOUTHLAKE BOULEVARD 
RICHMOND, VIRGINIA 23236 
804-794-2500 FAX: 804-794-8284 
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Kenwood TH-78A handheld to new 
purchasers. Dozens of TH-78s and 
other HTs would be there. Could TxID- 
1 display the unique features of many 
rigs of the same type? 

Mctron’s Tx!D-1 system consists of 
the data acquisition and control board 
that plugs into the expansion slot of an 
IBM PC or compatible computer, an in- 
terface board, and a PC software pro- 
gram written by George Hadiey N7SNI. 
TxiD-1 connects directly to the receiv- 
er’s discriminator and includes its own 
fast squelch circuit for uniform timing. 

For this experiment, | mounted the 
main board in WB6UZZ2's Compaq 
Portable 286 PC and connected it to a 
Bearcat BC210XL scanner (Photo A). 
The interface board (Photo B) plugs in- 
to the TxiD-1 main board and has con- 
nections for receiver discriminator 
(mandatory) and AGC (optional). The 
BC210 is easy to adapt to TxID-1. 
There is plenty of room inside, RCA 
jacks mount readily on the steel rear 
panel, and its discriminator tap-off 
point is easy to locate. 

Discriminator polarity and voltage 
swing differ among receiver models. To 
ensure that TxID-1 accurately displays 
the instantaneous frequency, you must 
calibrate the discriminator frequency- 
versus-voitage curve in 1 kHz steps. | 
used a TS-700A VFO-controlled rig 
and a VHF frequency counter to get 
the data for the BC21@XL passband in 
about 10 


minutes. 

With this data, running OPAMP.EXE 
(supplied on the program disk) calcu- 
lates values of two resistors to set gain 
and polarity of the input operational 
amplifier on the TxiD-1 board to match 
your receiver. | ran the program, found 
the resistors in my junkbox, and sol- 
dered them to the supplied component 
header in less than 15 minutes. Note 
that the whole procedure must be 
done over If you change receivers. 

| tested version 1.15, the current 
software revision, which is menu-driv- 
en with single-character commands. It 
supports the Microsoft Mouse, but not 
Windows. A 486 with fast hard drive 
and VGA/EGA monitor provides best 
performance, but a compatible with 
512K memory, CGA graphics, and a 
floppy drive will do. 

| tried to enter the frequency to be 
displayed in the fingerprint disk file, but 
the entry was not accepted. AA7Y 
says this is a software bug that will be 
fixed in the next revision. That is why 
all the plots in this review show 
00.0000 on the frequency line. The 
first signal | fingerprinted was a crys- 
tal-controlled repeater output (Figure 
1). Most repeaters have continuously 
running oscillator stages, so there is 
no PLL hunting. 

Immediately following the 200 mil- 
tisecond sample period, the program 
displays the fingerprint on the left side 
of the screen, along with the detected 
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CTCSS frequency, if any, and the sig- 
nai amplitude, if receiver AGC input is 
provided. From that point until the 
transmission ends, it decodes and dis- 
plays any DTMF digits received and 
determines the maximum deviation of 
voice and DTMF modulation. The dis- 
play also includes the date and exact 
time of transmission start and stop. 

A new fingerprint is produced each 
time a transmission begins. Of course, 
prints of repeater users must be made 
on the input frequency, as fingerprint 
data does not pass through the re- 
peater. If you accidentally set the re- 
ceiver to the output frequency, you will 
see the print of the repeater transmit- 
ter, not the user. 

With the MOVE command, you can 
put the fingerprint of your choice on 
the right side of the screen for compar- 
ison with incoming prints on the left 
(Figure 2), The COMPARE command 
(not shown in the figure) overlays the 
print from the right side onto the print 
on the left, in different colors if you 
have a color monitor. 

When COMPARE is commanded, 
the program automatically calculates a 
figure of merit for the difference in the 
two overlaid prints. “It subtracts the 
corresponding values of each super- 
sample, with a maximum allowable dif- 
ference value of 2 kHz each,” says 
N7SNI. “The 64 difference values are 
each squared, then ail are averaged.” 

Perfect correlation would give a 
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With DTMF and serial programming features, your controller is more secure from unwanted access. Talk out your Icom, 
Kenwood and Yaesu HF radios with your handheld. Make emergency autopatch calls. Have the nicest sounding audio on 
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you what time it is. Only the RLC-3 can give you all of these benefits in 1 affordable package 
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mean-square difference of zero. That 
rarely happens, but most rigs have on- 
ly smail differences between transmis- 
sions, whereas prints of non-identical 
rigs usually show much higher differ- 
ence numbers. The difference value is 
4 for the two transmissions of Figure 1, 
and 9 for those of Figure 2. 

By selecting the appropriate pro- 
gram mode, some or all fingerprints 
can be stored on disk. They can aiso 
be recorded on audio tape. Using a 
stereo tape deck, you can simultane- 
ously log user fingerprints and audio 
on the Jeft and right channels. The 
manual says the program will turn on 
your recorder at the start of a transmis- 
sion and delay the audio until it comes 
up to speed, but | did not test this fea- 
ture. 

| spent much time using the ANA- 
LYZE feature, which allows compari- 
son of fingerprints stored in one or 
more disk files. You can also put an 
annotation line on the prints and edit 
them down into a master file. The 
MOVE and COMPARE functions work 
perfectly with disk-stored prints, but 
there are minor program bugs in stor- 
ing and display of the DTMF and devi- 
ation data. 


The Acid Test 


So how did TxiD-1 do with different 
tigs of the same model? Very well! 
Most:times, the differences were obvi- 
ous, as shown in Figure 3. The mean- 
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square numeric value in the COM- 
PARE mode for these two prints is 
179. 

TH-78s and other Kenwood rigs 
settle on frequency much faster than 
other brands, so they were harder to 
tell apart. But it was still possible to 
find differences, usually in the final fre- 
quency after PLL settling. (Of course, 
this value might be affected by such 
factors as temperature fluctuations in 
the transmitter and/or receiver, so care 
must be used.) 

For fast-seitling rigs, it would be de- 
sirable to eliminate the 2 millisecond 
delay between squelch activation and 
start of the print. Phil says he is work- 
ing on a firmware upgrade that will 
store data io allow “looking back” be- 
fore the squelch opens, to the exact 
start of transmissions. 

A few HTs had wild variations in 
consecutive-transmission fingerprints, 
which turned out to be caused by 
near-dead batteries. Features such as 
a rig’s battery saver also cause 
changes in its fingerprint (Figure 4). 
Then there was one rig at the meeting 
that seemed to have an unlimited 
number of prints that were similar, but 
with definite differences. | compared 
10 prints from this rig and found only 7 
out of the 45 possible comparisons 
had mean-square difference numbers 
less than 100. To avoid giving aid and 
comfort to potential troublemakers, | 
will not reveal the make and model. 
Fortunately, other rigs of this type at 
the meeting did not have these varia- 
tions. 


Parting Shots 


Learning to use the TxID-1 is fairly 
easy and intuitive, but | can only give 
the manual a grade of C. It has plenty 
of detail to help you connect to re- 
ceivers and recording gear. There are 
advanced topics such as command- 
line parameters and script files. But in- 
formation on how to analyze and com- 
pare your prints is hard to find. For in- 
stance, there is no help in interpreting 
the mean-square difference function in 
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the COMPARE mode and no explana- 
tion why the CTCSS frequency read- 
out often gives false indications. 

Motron’s telephone support was 
very good, and | was able to get some 
added information on the program by 
reading the large (50K) heip file on the 
program disk. Don Moser of Motron 
says a new manual is coming, along 
with Revision 2 of the software. It will 
fix all the known bugs. Also in the 
works is a remote access feature. You 
will be able to put Tx!D-1 on the re- 
ceiver at your mountaintop repeater 
and downlink fingerprints via phone or 
packet radio. 

| would like to see some other im- 
provements in the software, such as a 
hard copy printout function. For the fig- 
ures in this article, | used the comput- 
ers “PRINT SCREEN” key with a dot 
matrix printer after running the 
“GRAPHICS” command from DOS. 
There should also be an faster and 
easier way to start and stop the finger- 
printing function without exiting to the 
MONITOR menu. 

It would also be great if TxID-1 
could be programmed to automatically 
search your database of known user 
transmitters and select the closest 
print or prints in it when your repeater 
is keyed up. This would be a faster 
way to identify “kerchunkers.” Also, 
how about a way to automatically alert 
the operator when a particular rig 
comes on the air? This would be es- 
pecially valuable when someone’s 
transceiver is stolen. Don, Phil, and 
George say they are working on such 
features. 

At $699 plus $8 shipping for the 
complete TxID-1 hardware and sofi- 
ware package plus the cost of the 
computer and receiver, the Moiron fin- 
gerprint system won't find its way into 
the average ham shack. However, it is 
well within the budget of many re- 
peater clubs and is certainly a worth- 
while addition to the arsenal of re- 
peater councils and interference com- 
mittees. 

From its introduction, Tx!D-1 has 


Photo B. The IA-1 interface Adapter board has jacks for receiver discriminator 


and S-meter input, plus tape recorder on/off and audio. It attaches to the TxID-1 
Transmitter Identifier board mounted inside the computer. The unused DB25 
connector is for optional RS-232 control of AR-3000 receivers. 


had steady sales to government, 
amateur, and commercial purchasers. 
But according to AA7Y, many cus- 
tomers don't want the fact that they 
own TxID-1 to be public knowledge. 
“Nonsense!” says K7PF. “A system like 
fingerprinting does no good unless 
people know about it. A ham from Vic- 
toria, British Columbia tells me that the 


TxID-1 is like having a shotgun by the 
door. It never needs to be used, but 
everybody knows its there just in 
case.” 

TxID-1 is not sold at ham stores. It 
is available only from Motron Electron- 
ics, 310 Garfield Street, Suite 4, PO 
Box 2748, Eugene OR 97402, (503) 
687-2118. 


Say You Saw It In 
73 Amateur Radio Today 


Factory Authorized Dealer & Service For 


@ VHF-UHF Transceivers 
@ HT's and Mobiles 


@ Amateur and SWL Antennas 
.@ Accessories and Parts 
@ RTTFY and FAX Equipment 
@ Books and Manuals. 
This catalog includes prices! 


Send 
$1 to 
cS 


Universal Radio 


Reynoldsburg, OH 43068 
Tel. 614 866-4267 


62 73 Amateur Radio Today * November, 1994 


6830 Americana Pkwy. 73 § 


BATTERIES 


Nickel-Cadmium, Alkaline, Lithium, 
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